By Dr Jolene Morse
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian
When leaders model bravery, when staff feel safe to speak, and when organisations measure what matters, governance is no longer about protecting against failure.
Every corporate scandal of the past decade — banking misconduct, aged care failures, cybersecurity breaches — all had something in common: the governance, risk and compliance (GRC) frameworks were already in place. The registers were up to date. The policies had been approved. The training modules had been completed. And yet – the failures still happened. The uncomfortable truth is this: box-ticking GRC is killing organisations from the inside out.
Boards and executives cling to dashboards that glow green. Regulators receive pages of compliance attestations. Staff are marched through e-learning modules that no one remembers the next day. This creates the illusion of safety — the belief that risk has been managed because the paperwork has been filed.
But the reality tells a different story. The Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry found that misconduct was not a result of absent frameworks, but of frameworks that were ignored, gamed, or treated as box-ticking exercises. Aged care inquiries repeatedly exposed providers who could point to policies on dignity and care while residents lived in unsafe, inhumane conditions. Cybersecurity breaches like those at Optus and Medibank revealed that documented cyber strategies existed, but cultural complacency left vulnerabilities wide open. When GRC becomes compliance theatre, risk is not reduced — it is concealed.
Let’s be honest: the GRC profession has been complicit. We have measured the wrong things for too long. Completion rates. Number of policies. Internal audit cycles. These are outputs, not outcomes.
True risk culture isn’t about how many boxes were ticked. It’s about whether people have the courage to speak up when they see misconduct. It’s about whether executives model transparency rather than protecting reputations. It’s about whether boards demand real evidence of behaviour — not just reports curated for comfort.
ISO 31000 puts culture at the centre of risk management. APRA’s CPS 220 requires boards to monitor and assess their organisation’s risk culture. WorkSafe’s psychosocial safety regulations demand organisations address not just physical hazards but also bullying, workload, and toxic leadership. The world is moving toward culture as the critical success factor in GRC. Yet many organisations are still stuck in the paperwork era. This requires bravery, and bravery has been missing from too many governance conversations.
A brave GRC system doesn’t hide behind dashboards. It shines a light on what’s uncomfortable.
- Incident reporting rates go up, not down. In a strong culture, people report more issues because they trust the system. Suppressed reporting is a red flag, not a success.
- Leaders admit mistakes. Cover-ups breed collapse. When executives acknowledge failures openly, it signals that learning is valued more than perfection.
- Boards demand transparency in decision-making. They don’t settle for “risk noted” in minutes; they require clear explanations of why decisions were made and how risks were balanced against values.
- Near misses are treated as gold. Each one is a free lesson. Brave cultures encourage staff to share them, analyse them, and apply the learnings.
- Compliance is a conversation, not a module. Training is linked to lived examples, case studies, and dialogue, not just passive click-throughs.
Bravery shows up in everyday practice. It’s a leader inviting challenge in a meeting. It’s a junior nurse flagging a safety concern without fear of reprisal. It’s a director questioning a report that looks too clean to be real.
The cost of inaction is staggering. Billions in fines, remediation, and compensation. CEOs stepping down in disgrace. Communities losing trust in institutions. Staff demoralised in workplaces that punish honesty and reward silence.
The Royal Commission into Banking put it bluntly: misconduct was driven not by a lack of rules, but by a culture of greed, fear, and silence. In aged care, tragic failures in dignity and safety occurred in facilities that had every required policy but lacked the will to embed them. Cyber breaches now cost organisations not just in recovery, but in reputational damage and customer trust that takes years to rebuild. Cowardly GRC erodes trust, reputation, and long-term value. Brave GRC builds resilience, earns community confidence, and creates organisations worth working for.
The future of GRC will not be won by those with the most policies, the longest registers, or the highest training completion rates. Those are relics of the box-ticking era. The future belongs to organisations that are brave enough to measure what matters — trust, psychological safety, ethical leadership, and decision-making under pressure.
Boards and executives need to ask harder questions:
- What are staff afraid to tell us?
- Where do we rely on metrics that make us feel safe but mean nothing?
- How do we know people are doing the right thing when no one is watching?
The answers may be uncomfortable. But they are where the real work of GRC begins.
It is time to stop confusing compliance activity with risk culture maturity. A completed checklist does not equal safety, resilience, or integrity. To meet the challenges of today’s environment, organisations need to shift from box-ticking to bravery — from a compliance-driven façade to a culture of courage, trust, and accountability.
When leaders model bravery, when staff feel safe to speak, and when organisations measure what matters, governance is no longer about protecting against failure. It becomes about enabling better decisions, stronger trust, and a more resilient future.
We don’t need more checklists. We need courage.